H33 API Documentation
The complete post-quantum authentication API. FHE biometrics, ZK proofs, quantum signatures, blockchain attestation. All in one platform, at 2,648 microseconds.
Quick Start
Get started in 3 steps
Authentication
All API requests require authentication using your API key in the Authorization header.
h33_test_* - Test keys, sandbox environment (no auths consumed)
Key Management
API keys can be created, rotated, and revoked from your dashboard. We recommend:
- Using different keys for different environments
- Rotating keys every 90 days
- Never committing keys to version control
Pricing & Usage
H33 uses per-auth pricing with included monthly auths. Annual plans get 2 months free (~17% off).
Security Level Surcharges
Higher security levels add a per-auth surcharge:
| Tier | Surcharge | Latency | Description |
|---|---|---|---|
| H0 ⚠️ | 1 | 356µs | Dev/testing only (~57-bit) |
| H1 | 3 | ~480µs | Lightweight FHE (~86-bit) |
| H2 ✓ | 4 | removed | Full FHE, deep circuits (NIST L1) |
| H33 ⭐ | 10 | 1.36ms | Zero exposure flagship (NIST L1) |
| H-256 ✓ | 25 | 5.98ms | NIST L5 + k-of-n threshold |
KYC / Identity (Fixed Pricing)
| Service | Price | Includes |
|---|---|---|
| KYC Basic + SBT | $49 | ID, Selfie, Liveness, Soulbound NFT |
| KYC Enhanced + SBT | $79 | + Proof of Address verification |
| AML/PEP Screening | $19 | Sanctions, PEP, Adverse Media |
| Full Bundle | $99 | KYC + AML + Soulbound NFT |
Full Stack Auth
Complete post-quantum authentication in a single call. Combines FHE-encrypted biometric matching, zero-knowledge proof generation, quantum-resistant signature, and blockchain attestation.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
userId |
string | Required | Unique identifier for the user |
biometric |
object | Required | Biometric data (face, voice, or fingerprint) |
biometric.type |
string | Required | "face" | "voice" | "fingerprint" |
biometric.data |
string | Required | Base64-encoded biometric data |
mode |
string | Optional | "h0" (dev only ~57-bit) | "h1" (fast non-NIST) | "h2" (NIST L1) | "h33" (1.36ms NIST L1, default) | "h-256" (5.98ms NIST L5) |
zkClaims |
object | Optional | Additional claims to include in ZK proof |
blockchain |
object | Optional | Blockchain attestation options |
Example Request
Example Response
Biometric Enroll
Enroll a new biometric template. The template is encrypted using FHE before storage — we never see or store raw biometric data. Accepts base64-encoded images or pre-extracted float32 embedding vectors.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
userId |
string | Required | Unique identifier for the user |
biometric |
object | Optional | Biometric data to enroll (use this OR embedding) |
biometric.type |
string | Required | "face" | "voice" | "fingerprint" | "iris" |
biometric.data |
string | Optional | Base64-encoded biometric image/audio |
embedding |
number[] | Optional | Pre-extracted float32 embedding vector. 512-D (face), 192-D (voice), 256-D (fingerprint), 1024-D (iris). Use instead of biometric.data when sending model output directly. |
adapter |
string | Optional | "arcface" | "speechbrain" | "sourceafis" — auto-validates dimension, checks for NaN, and L2-normalizes. See SDK Guide |
mode |
string | Optional | "q-dev" | "q2" | "q-256" |
Biometric Verify
Verify a biometric sample against an enrolled template. Matching is performed entirely on encrypted data using FHE — the raw biometric never leaves your device. Accepts base64 images or pre-extracted embedding vectors.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
userId |
string | Required | User to verify against enrolled template |
embedding |
number[] | Optional | Pre-extracted float32 embedding vector. Use instead of biometric.data. |
biometric |
object | Optional | Biometric data (use this OR embedding) |
adapter |
string | Optional | "arcface" | "speechbrain" | "sourceafis" — auto-validates and normalizes |
Liveness Session
Create a challenge-response anti-spoofing session. Returns challenges (blink, head turn, speech phrase) that the user must complete before biometric verification proceeds. Detects photo attacks, replays, deepfakes, and synthetic media.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
biometricType |
string | Required | "face" | "voice" |
riskLevel |
string | Optional | "low" | "medium" | "high" — controls number and difficulty of challenges. Default: "medium" |
Verify + Liveness
Liveness check first, then FHE biometric verification. If the liveness check fails (spoofing detected), the FHE verification is never executed — no compute wasted on attacks. Returns both liveness result and verification result.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
userId |
string | Required | User to verify against enrolled template |
embedding |
number[] | Required | Pre-extracted float32 embedding vector |
sessionId |
string | Required | Liveness session ID from /biometric/liveness-session |
capture |
object | Required | Biometric capture data for liveness analysis |
capture.faceFrames |
object[] | Optional | Array of face frames with timestamps, landmarks, and frame hashes |
capture.voiceSegments |
object[] | Optional | Array of voice segments with audio features and spectral data |
capture.challengeResults |
object[] | Optional | Completed challenge-response results from the liveness session |
Voice: Replay detection, synthetic speech, frequency analysis, environmental consistency
Deepfake: GAN artifact detection, temporal coherence, challenge-response verification
Unenroll (Delete)
Cryptographically delete an enrolled biometric template. The BFV ciphertext is destroyed and a Dilithium-signed deletion receipt is returned as proof of destruction. Satisfies BIPA 15(a), GDPR Article 17, CCPA 1798.105.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
userId |
string | Required | User whose template to delete |
enrollmentId |
string | Optional | Specific enrollment to delete. If omitted, deletes all enrollments for user. |
FHE Encryption
Encrypt data using Fully Homomorphic Encryption. Encrypted data can be processed without decryption, enabling privacy-preserving computation.
FHE Modes
| Mode | Latency | Parameter N | Use Case |
|---|---|---|---|
| H0 | 356µs | N=1,024 | Dev/testing only (~57-bit) |
| H1 | ~480µs | N=2,048 | Fast non-NIST (~85-bit) |
| H2 | removed | N=4,096 | Deep circuits (128-bit NIST L1) |
| H33 | 1.36ms | N=4,096 | Production default (128-bit NIST L1) |
| H-256 | 5.98ms | N=16,384 | Max security (256-bit NIST L5) |
FHE Compute
Perform computations on encrypted data. Supports addition, multiplication, comparison, and custom operations without ever decrypting.
Zero-Knowledge Proofs
Generate a zero-knowledge proof. Prove statements about your data without revealing the data itself. Uses H33 ZKP STARK Lookup — SHA3-256 hash, post-quantum safe, no trusted setup.
Supported Proof Types
| Scheme | Proof Size | Verify Time | Notes |
|---|---|---|---|
| H33 ZKP Stark Lookup (Production) | 105 bytes | 2.09ns (cached) | Production auth ZK. STARK Lookup, SHA3-256 hash, PQ-safe |
| KZG | ~200 bytes | ~3ms | Biometric ZKP commitment scheme |
| IPA | ~1KB | ~10ms | No trusted setup, biometric ZKP |
Verify a zero-knowledge proof. Returns true if the proof is valid for the given public inputs and verification key.
Quantum Signatures
NIST FIPS 203/204 compliant post-quantum digital signatures. Resistant to attacks from both classical and quantum computers.
CRYSTALS-Kyber - Key encapsulation (FIPS 203)
Sign data using a quantum-resistant algorithm. Default: Dilithium3 (NIST security Level 3).
Blockchain Attestation
Create an immutable attestation record on Solana. Perfect for audit trails, compliance records, and tamper-proof logging.
Mint a Soulbound Token (non-transferable NFT) representing verified identity credentials. Included with KYC packages.
KYC Verification
Complete KYC verification with FHE-encrypted biometrics, ZK proofs, and blockchain attestation. Includes Soulbound NFT minting.
Pricing
| Package | Price | Includes |
|---|---|---|
| KYC Basic + SBT | $49 | ID + Selfie + Liveness + Soulbound NFT |
| KYC Enhanced + SBT | $79 | Basic + Proof of Address |
| Full Bundle | $99 | Enhanced KYC + AML + Soulbound NFT |
Continuous Authentication
Real-time continuous authentication using multi-modal behavioral biometrics. LSTM-based temporal modeling of keystroke, mouse, face, and voice patterns.
Invisible Authentication
Zero-transmission authentication. No codes displayed on screen. Authentication keys are hardware-secured and never transmitted over the network.
Estate Fraud Detection
Detect behavioral anomalies indicating potential estate fraud. Analyzes shifts from deceased user baselines and detects beneficiary collusion patterns. Generates court-admissible evidence packages.
Bundled Services
High-performance bundled endpoints using h33_fhe and h33_stark internally—our fastest, most secure implementations.
Complete authentication in one call. Uses h33_fhe for encryption and h33_stark for proof generation. Returns verified identity with quantum-resistant signatures.
Request Body
Response
Encrypt and Prove
FHE encryption with ZK proof in one call. Encrypts data using h33_fhe and generates a H33 ZKP STARK Lookup proof of correct encryption. 2.0µs (async) prove, 2.09ns (cached) verify, 105-byte proof.
Request Body
Response
Secure Compute
FHE computation with correctness proof. Performs operations on encrypted data and generates a H33 ZKP Stark Lookup proof that the computation was performed correctly.
Request Body
Response
Key Ceremony
Multi-party key generation ceremony. Securely generates shared keys across multiple participants using MPC protocols with quantum-resistant algorithms.
Request Body
Response
SDK Initialization
Initialize the H33 SDK with your configuration. Returns optimized settings and pre-computed parameters for subsequent API calls.
Request Body
Response
Bundled Status
Health check for bundled services. Returns status of h33_fhe, h33_stark, and all bundled endpoint availability.
Response
Error Codes
All API errors return a consistent JSON structure with an error code and message.
| Code | HTTP | Description |
|---|---|---|
INVALID_API_KEY |
401 | API key is missing, invalid, or revoked |
QUOTA_EXCEEDED |
429 | Monthly auth quota exceeded |
INVALID_BIOMETRIC |
400 | Biometric data is malformed or unreadable |
USER_NOT_ENROLLED |
404 | No biometric template found for user |
VERIFICATION_FAILED |
200 | Biometric match failed (not an error) |
LIVENESS_FAILED |
403 | Anti-spoofing liveness check failed |
SPOOFING_DETECTED |
403 | Spoofing attack detected (photo, replay, deepfake) |
SESSION_EXPIRED |
410 | Liveness session expired — create a new session |
ADAPTER_VALIDATION_FAILED |
400 | Embedding failed adapter validation (wrong dimension, NaN, zero vector, L2 norm out of range) |
CIRCUIT_NOT_FOUND |
404 | ZK circuit ID not found |
PROOF_INVALID |
400 | ZK proof verification failed |
BLOCKCHAIN_ERROR |
502 | Blockchain network error |
SDKs & Libraries
Official client libraries with TypeScript definitions, async/await support, and automatic retries.
SDK Features
- Full TypeScript definitions
- Automatic retry with exponential backoff
- Request/response logging
- Webhook signature verification
- Secure enclave integration (mobile)
- Biometric capture helpers
- Biometric SDK Integration Guide → ArcFace, SpeechBrain, SourceAFIS adapters